Privacy policy
This document is a preliminary version pending review by legal counsel. Not applicable until final legal validation.
Last updated: 12 May 2026.
1. Data controller
HoldPixel S.L., Spanish Tax ID [pending], registered office in [pending], Spain, is the controller of personal data collected through this website and the cloud management panel.
Data Protection Officer contact: dpo@holdpixel.com.
2. Data we collect
- Identification and contact data: name, surname, email, optional phone.
- Billing and shipping data: postal address, tax details (VAT / Tax ID), country.
- Payment data: processed directly by the gateway (Shopify Payments / Stripe). HoldPixel does not store full card details.
- Panel data: event agenda, attendee lists (if the customer uploads them), graphic assets, fleet configuration.
- Technical data: IP address, browser, operating system, pages visited on this site.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Order management and Hardware delivery | Performance of contract (art. 6.1.b) |
| Provision of the cloud panel and fleet publishing service | Performance of contract (art. 6.1.b) |
| Compliance with tax and accounting obligations | Legal obligation (art. 6.1.c) |
| Newsletter and commercial communications | Consent (art. 6.1.a) |
| Fraud prevention and service security | Legitimate interest (art. 6.1.f) |
| Handling enquiries and support | Performance of contract or legitimate interest |
4. Disclosures and international transfers
Your data may be shared with the following processors, all bound by data processing agreements under article 28 GDPR:
- Shopify Inc. and/or Stripe Payments Europe Ltd. — payment processing and order management.
- Cloudflare Inc. — cloud panel hosting and website CDN.
- Logistics operator [pending — Correos / SEUR / equivalent] — Hardware shipping.
- Transactional email provider [pending — Resend / Postmark / equivalent] — magic links, confirmations, notices.
Some of these processors may process data outside the EEA. International transfers take place under the European Commission's approved Standard Contractual Clauses (SCC).
5. Retention periods
- Accounting and tax data: 6 years under the Spanish Commercial Code and General Tax Act.
- Contractual relationship data: 5 years from end of relationship.
- Panel data: for the duration of the cloud panel subscription, plus a 90-day grace period for download / portability.
- Marketing data: until consent withdrawal.
6. Your rights
Under GDPR and Spanish Organic Law 3/2018 (LOPDGDD), you have the right to:
- Access your data.
- Request rectification or deletion.
- Object to processing and request its restriction.
- Receive your data in a portable format.
- Withdraw your consent at any time (without affecting prior lawfulness).
- Lodge a complaint with the Spanish Data Protection Agency (aepd.es) if you consider the processing unlawful.
To exercise these rights, write to dpo@holdpixel.com attaching a copy of your ID or equivalent.
7. Data generated by the badges
HoldPixel badges do not collect personally identifiable data: they operate with anonymous identifiers that the customer may, optionally, map to attendee profiles in their own panel. They have no microphone and no camera. Aggregate interaction data (game participation, zone transitions) is stored in the customer's panel, and the customer is the controller for the personal data of its attendees.
8. Security
We apply appropriate technical and organizational measures to ensure data security: TLS encryption in transit, encryption at rest, role-based access control, audit logs, encrypted backups, and periodic security assessments.
9. Changes to this policy
We may update this policy. The version in force is the one published on this site with its update date. Substantial changes will be notified via email to customers with an active account.